clay-server 4.0.0-beta.13 → 4.0.0-beta.14

package/lib/project-log-feedback-delivery.js

@@ -0,0 +1,76 @@
+// Deliver new Project Log comments to the exact live session responsible for
+// the canonical entry. Comments remain durable in the ledger when that session
+// is gone; this module never guesses another session or creates one.
+
+function attachProjectLogFeedbackDelivery(ctx) {
+  var sm = ctx.sm;
+  var getSdk = ctx.getSdk;
+  var onProcessingChanged = ctx.onProcessingChanged || function () {};
+  var getLinuxUserForSession = ctx.getLinuxUserForSession || function () { return null; };
+
+  function findAuthorSession(entry) {
+    var author = entry && entry.updatedBy;
+    if (!author || author.type !== "session" || !author.sessionKey) return null;
+    var match = null;
+    sm.sessions.forEach(function (session) {
+      if (match || !session || session.destroying || session.hidden) return;
+      if (session.cliSessionId !== author.sessionKey && "local:" + session.localId !== author.sessionKey) return;
+      if ((session.ownerId || null) !== (author.userId || null)) return;
+      if (sm.sessions.get(session.localId) !== session) return;
+      match = session;
+    });
+    return match;
+  }
+
+  function feedbackPrompt(entry) {
+    return "[Project Log feedback]\n" +
+      "A user added a comment to " + entry.ref + ". Review the pending feedback now with list_log_feedback, " +
+      "then resolve this specific comment through review_log_comment. Apply supported corrections to the canonical " +
+      "entry; otherwise clarify or decline with a concise reason. Do not treat this internal notification as user " +
+      "chat or answer it only in the conversation.\n" +
+      "[End Project Log feedback]";
+  }
+
+  function deliver(entry) {
+    if (!entry || !entry.ref || !entry.pendingFeedbackCount) return false;
+    var session = findAuthorSession(entry);
+    var sdk = getSdk();
+    if (!session || !sdk) return false;
+    var text = feedbackPrompt(entry);
+    sm.sendAndRecord(session, {
+      type: "user_message",
+      text: text,
+      _internal: true,
+      projectLogFeedback: true,
+      projectLogRef: entry.ref,
+    });
+    session.lastActivity = Date.now();
+    if (!session.isProcessing) {
+      session.isProcessing = true;
+      session.sentToolResults = {};
+      onProcessingChanged();
+      sm.sendToSession(session, { type: "status", status: "processing" });
+    }
+    if (!sdk.pushMessage(session, text)) {
+      session._queryStartTs = Date.now();
+      Promise.resolve(sdk.startQuery(session, text, null, getLinuxUserForSession(session))).catch(function (error) {
+        session.isProcessing = false;
+        sm.sendAndRecord(session, {
+          type: "error",
+          text: "Could not deliver Project Log feedback: " + (error.message || String(error)),
+          _internal: true,
+        });
+        onProcessingChanged();
+      });
+    }
+    sm.broadcastSessionList();
+    return true;
+  }
+
+  return {
+    deliver: deliver,
+    findAuthorSession: findAuthorSession,
+  };
+}
+
+module.exports = { attachProjectLogFeedbackDelivery: attachProjectLogFeedbackDelivery };

package/lib/project-logs.js

@@ -88,6 +88,7 @@ function attachProjectLogs(ctx) {
   var sendTo = ctx.sendTo;
   var getClients = ctx.getClients || function () { return []; };
   var getProjectOwnerId = ctx.getProjectOwnerId || function () { return null; };
+  var onFeedback = ctx.onFeedback || function () {};
 
   // Every socket in this project's client set passed the project access check
   // at WebSocket upgrade, so a broadcast here is already scoped to authorized
@@ -204,6 +205,9 @@ function attachProjectLogs(ctx) {
       if (msg.type === "project_log_comment") {
         var commented = bound.commentLog({ ref: msg.ref, body: msg.body });
         sendTo(ws, { type: "project_log_commented", requestId: requestId, entry: commented });
+        try { onFeedback(commented); } catch (deliveryError) {
+          console.error("[project-logs] Failed to deliver comment:", deliveryError.message || deliveryError);
+        }
         return true;
       }
     } catch (e) {

package/lib/project-pair-lifecycle.js

@@ -1,13 +1,13 @@
 // Autonomous Split Worker lifecycle: bounded status, atomic replacement, and
 // the per-generation evaluation ledger.
 //
-// A qualified Driver manages its visible Worker without asking the user: it
+// A Driver manages its visible Worker without asking the user: it
 // decides reuse against replacement from exact server-derived accounting, and
 // it replaces in one operation rather than a close/create dance. Nothing here
 // posts a proposal or waits for an approval card.
 //
 // Everything is bound to the exact live pair. The Driver is re-resolved from
-// the split store on every call, its eligibility is re-checked every time, and
+// the split store on every call, its structural capability is re-checked every time, and
 // ownership must match on both sessions. No active-tab or global-session
 // fallback exists in this module.
 //
@@ -187,7 +187,7 @@ function attachPairLifecycle(ctx) {
     return record;
   }
 
-  // The exact pair, with the Driver's eligibility re-checked on every call.
+  // The exact pair, with the Driver's structural capability re-checked on every call.
   function resolveDriverPair(caller) {
     if (!caller) throw new Error("pair lifecycle tools require a session-bound tool server");
     // Exact live object identity, before anything is read off the caller. A
@@ -206,7 +206,7 @@ function attachPairLifecycle(ctx) {
     var worker = sm.sessions.get(group.pair.workerId);
     if (!worker) throw new Error("split partner session was not found");
     if ((caller.ownerId || null) !== (worker.ownerId || null)) throw new Error("split partner access denied");
-    return { group: group, worker: worker, tier: verdict.tier };
+    return { group: group, worker: worker };
   }
 
   function replaceBlockedReason(worker) {
@@ -246,7 +246,6 @@ function attachPairLifecycle(ctx) {
       orchestration: turnControl.status(caller),
       replaceSafe: !blocked,
       replaceBlockedReason: blocked,
-      driverTier: resolved.tier ? resolved.tier.name : null,
       generations: ledger,
     };
   }

package/lib/project-session-pair.js

@@ -381,7 +381,7 @@ function attachSessionPair(ctx) {
     // Mount for the query lifetime; handlers re-resolve live pair state.
     var group = store.groupForMember(boundSession.localId);
     if (group && group.pair && group.pair.driverId !== boundSession.localId) return [];
-    // Plain splits keep base tools; autonomous Drivers must pass the tier gate.
+    // Every project chat model may drive; the check only excludes non-chat surfaces.
     var adHocSplit = !!(group && !group.pair);
     if (!adHocSplit && !driverEligibility.isEligibleDriverSession(boundSession, sm)) return [];
     var lifecycleHandlers = lifecycle.toolHandlers(boundSession);

package/lib/project.js

@@ -51,6 +51,7 @@ var { attachSessionDocument } = require("./project-session-document");
 var { attachCapsuleCatalog } = require("./project-capsule-catalog");
 var { attachProjectWorkspaceQuery } = require("./project-workspace-query");
 var { attachProjectLogs } = require("./project-logs");
+var { attachProjectLogFeedbackDelivery } = require("./project-log-feedback-delivery");
 var { attachProjectMateKnowledge } = require("./project-mate-knowledge");
 var { attachSplitGroups } = require("./session-split-groups");
 var toolControlMcp = require("./tool-control-mcp-server");
@@ -670,6 +671,12 @@ function createProjectContext(opts) {
     isMate: isMate,
     mateId: mateId,
   });
+  var _logFeedbackDelivery = attachProjectLogFeedbackDelivery({
+    sm: sm,
+    getSdk: function () { return sdk; },
+    onProcessingChanged: onProcessingChanged,
+    getLinuxUserForSession: getLinuxUserForSession,
+  });
   var _projectLogs = attachProjectLogs({
     service: opts.projectLogsService || null,
     sm: sm,
@@ -679,6 +686,7 @@ function createProjectContext(opts) {
     mateId: mateId,
     sendTo: sendTo,
     getClients: function () { return clients; },
+    onFeedback: _logFeedbackDelivery.deliver,
   });
   var _mateKnowledge = attachProjectMateKnowledge({
     service: opts.mateKnowledgeService || null,

package/lib/sdk-bridge.js

@@ -664,6 +664,14 @@ function createSDKBridge(opts) {
       return { behavior: "allow", updatedInput: input };
     }
 
+    // Project Logs are exact-session, project-bound tools whose authority is
+    // enforced again by the server binding. Canonical changes are append-only
+    // revisions, and the surface exposes no destructive delete operation, so
+    // a second provider permission prompt adds no additional safety.
+    if (toolName.indexOf("mcp__clay-logs__") === 0) {
+      return { behavior: "allow", updatedInput: input };
+    }
+
     // This tool only prepares a read-only UI projection for the document the
     // agent is about to edit. The subsequent Edit/Write keeps its own normal
     // permission behavior.

package/lib/sdk-message-processor.js

@@ -3,6 +3,8 @@ var yoke = require("./yoke");
 var backgroundTaskTiming = require("./background-task-timing");
 var sessionTitlePolicy = require("./session-title-policy");
 
+var OVERLOAD_RETRY_LIMIT = 3;
+
 function attachMessageProcessor(ctx) {
   var sm = ctx.sm;
   var send = ctx.send;
@@ -487,6 +489,8 @@ function attachMessageProcessor(ctx) {
       }
 
     } else if (parsed.yokeType === "result") {
+      var overloadAbortRequested = !!session._overloadAbortRequested;
+      session._overloadAbortRequested = false;
       session.blocks = {};
       session.sentToolResults = {};
       session.pendingPermissions = {};
@@ -532,7 +536,9 @@ function attachMessageProcessor(ctx) {
         session._awaitingTurnResult = false;
         session._queuedTurnCount = 0;
         onProcessingChanged();
-        sendAndRecord(session, { type: "error", text: "Claude error: " + execError });
+        if (!overloadAbortRequested) {
+          sendAndRecord(session, { type: "error", text: "Claude error: " + execError });
+        }
         sendAndRecord(session, { type: "done", code: 1 });
         sm.broadcastSessionList();
         return;
@@ -819,9 +825,33 @@ function attachMessageProcessor(ctx) {
       }
 
     } else if (parsed.yokeType === "api_retry") {
-      // Transient retry notification, show in UI but don't persist in history
-      var retryText = parsed.message || parsed.error || "Retrying API request...";
-      sendToSession(session, { type: "system_info", text: retryText });
+      // The Claude SDK may otherwise paint one persistent red error for every
+      // retry and remain busy for many minutes. Show one transient status, and
+      // stop a repeatedly overloaded turn after a small bounded number of
+      // attempts so the user regains control and can retry or change models.
+      var apiRetryAttempt = parsed.attempt || 1;
+      if (parsed.error === "overloaded") {
+        if (apiRetryAttempt === 1) {
+          session._overloadAbortRequested = false;
+          sendToSession(session, {
+            type: "system_info",
+            text: "The model is overloaded. Retrying briefly...",
+          });
+        }
+        if (apiRetryAttempt >= OVERLOAD_RETRY_LIMIT && !session._overloadAbortRequested) {
+          session._overloadAbortRequested = true;
+          sendAndRecord(session, {
+            type: "error",
+            text: "The model remained overloaded after " + apiRetryAttempt +
+              " attempts, so this turn was stopped. Try again or choose another model.",
+          });
+          if (session.abortController && typeof session.abortController.abort === "function") {
+            try { session.abortController.abort(); } catch (e) {}
+          }
+        }
+      } else if (apiRetryAttempt === 1) {
+        sendToSession(session, { type: "system_info", text: "The model request failed temporarily. Retrying..." });
+      }
 
     } else if (parsed.yokeType === "commands_changed") {
       // Mid-session command list change: rebuild the union with skills (same as

package/lib/session-driver-eligibility.js

@@ -1,183 +1,30 @@
-// Driver eligibility: which models may hold the Driver role of a visible
-// Driver/Split Worker pair and receive the autonomous lifecycle tools.
+// Driver capability for a visible Driver/Split Worker pair.
 //
-// There is no canonical tier helper in the repo to reuse. Claude models are
-// enumerated by the SDK at runtime, so there is no static list; Codex ships a
-// fixed catalog in yoke/adapters/codex.js. What both have in common is a tier
-// token in the model id and in its display name, which the existing
-// project-worker-proposal.js already keys on ("fable"). This module makes that
-// same idea explicit, ordered, and vendor-scoped.
-//
-// Ranks are per vendor family and are only ever compared within a family; no
-// cross-vendor ranking is implied or invented.
-//
-//   claude family   haiku 1  <  sonnet 2  <  opus 3  <  fable 4
-//                   real ids: claude-haiku-4-5-20251001, claude-sonnet-5,
-//                             claude-opus-5, claude-fable-5
-//                   Driver threshold: fable
-//
-//   codex family    gpt-5.2 1 < gpt-5.5 2 < luna 3 < sol 4 < terra 5
-//                   real ids: the CODEX_MODELS catalog, strongest first
-//                   Driver threshold: sol
-//
-// Matching is by token, not by exact id, so a later release in the same family
-// (claude-fable-6, gpt-5.7-terra) stays eligible without a code change. A
-// model in a known family whose tier token is unrecognized is NOT eligible:
-// unknown capability fails closed rather than inheriting the threshold.
-//
-// Any other vendor is not eligible for the Driver role at all, because no
-// equivalent tier metadata exists to compare against. Those vendors remain
-// perfectly usable as Workers.
-
-var models = require("./project-models");
-
-var FAMILIES = {
-  claude: {
-    label: "Claude",
-    threshold: 4,
-    thresholdName: "Fable",
-    // Longest/most specific tokens first so "haiku" cannot shadow a future
-    // compound name. Each entry is a token searched in id and display name.
-    tiers: [
-      { token: "fable", rank: 4, name: "Fable" },
-      { token: "opus", rank: 3, name: "Opus" },
-      { token: "sonnet", rank: 2, name: "Sonnet" },
-      { token: "haiku", rank: 1, name: "Haiku" },
-    ],
-  },
-  codex: {
-    label: "OpenAI",
-    threshold: 4,
-    thresholdName: "Sol",
-    tiers: [
-      { token: "terra", rank: 5, name: "Terra" },
-      { token: "sol", rank: 4, name: "Sol" },
-      { token: "luna", rank: 3, name: "Luna" },
-      { token: "gpt-5.5", rank: 2, name: "GPT-5.5" },
-      { token: "gpt-5.2", rank: 1, name: "GPT-5.2" },
-    ],
-  },
-};
-
-function familyFor(vendor) {
-  var key = String(vendor || "").toLowerCase();
-  return Object.prototype.hasOwnProperty.call(FAMILIES, key) ? FAMILIES[key] : null;
-}
-
-// Every string the catalog knows this model by. The catalog entry is found with
-// the repo's own matcher so an alias ("fable"), an id, or a resolvedModel all
-// resolve to the same entry, and the display name participates in tier
-// detection exactly as project-worker-proposal.js already relies on.
-function searchTextFor(vendor, model, modelsByVendor) {
-  var parts = [String(model || "")];
-  var catalog = (modelsByVendor && modelsByVendor[vendor]) || [];
-  for (var i = 0; i < catalog.length; i++) {
-    if (!models.modelEntryMatches(catalog[i], model)) continue;
-    var entry = catalog[i];
-    if (typeof entry === "string") {
-      parts.push(entry);
-    } else {
-      parts.push(entry.value || "");
-      parts.push(entry.id || "");
-      parts.push(entry.resolvedModel || "");
-      parts.push(entry.displayName || "");
-      parts.push(entry.name || "");
-    }
-    break;
-  }
-  return parts.join(" ").toLowerCase();
-}
-
-// Resolve the tier of one model inside its vendor family. Returns null when
-// the vendor has no tier metadata or the tier token is unrecognized.
-function resolveTier(vendor, model, modelsByVendor) {
-  var family = familyFor(vendor);
-  if (!family || !model) return null;
-  var text = searchTextFor(vendor, model, modelsByVendor);
-  for (var i = 0; i < family.tiers.length; i++) {
-    if (text.indexOf(family.tiers[i].token) !== -1) {
-      return {
-        vendor: String(vendor).toLowerCase(),
-        family: family.label,
-        rank: family.tiers[i].rank,
-        name: family.tiers[i].name,
-        threshold: family.threshold,
-        thresholdName: family.thresholdName,
-      };
-    }
-  }
-  return null;
-}
-
-// The hard invariant. Returns { ok, tier, error } and never throws. `error` is
-// a complete English sentence suitable for returning to a tool caller.
-function evaluateDriverModel(vendor, model, modelsByVendor) {
-  var family = familyFor(vendor);
-  if (!family) {
-    return {
-      ok: false,
-      tier: null,
-      error: "The Driver role requires a Claude model of Fable tier or higher, or an OpenAI model of " +
-        "Sol tier or higher. Vendor \"" + String(vendor || "unknown") + "\" has no comparable tier " +
-        "metadata, so it cannot take the Driver role. It can still be used for the Split Worker.",
-    };
+// Model and vendor choice belongs to the user. A session does not need to
+// clear a model-tier threshold to coordinate a Split Worker; runtime catalog
+// validation belongs to session-pair-factory.js and applies equally to every
+// requested role. The only session-level exclusion here is structural: an
+// embedded terminal has no project chat surface on which to host the Driver
+// controls or the paired pane.
+
+function evaluateDriverSession(session) {
+  if (!session) {
+    return { ok: false, error: "No session was bound to this request." };
   }
-  if (!model) {
-    return {
-      ok: false,
-      tier: null,
-      error: "This session has no resolved model yet, so its " + family.label +
-        " tier cannot be confirmed. The Driver role requires " + family.thresholdName +
-        " tier or higher.",
-    };
-  }
-  var tier = resolveTier(vendor, model, modelsByVendor);
-  if (!tier) {
-    return {
-      ok: false,
-      tier: null,
-      error: "Model \"" + model + "\" is not a recognized " + family.label +
-        " tier, so it cannot take the Driver role. The Driver role requires " +
-        family.thresholdName + " tier or higher.",
-    };
-  }
-  if (tier.rank < tier.threshold) {
-    return {
-      ok: false,
-      tier: tier,
-      error: "The Driver role requires a " + family.label + " model of " + family.thresholdName +
-        " tier or higher. This session is " + tier.name + " tier.",
-    };
-  }
-  return { ok: true, tier: tier, error: null };
-}
-
-// The session-level form. Resolves the session's effective model the same way
-// the rest of the server does: the session's own model, else the vendor
-// default. Identity is read from the session object, never from a caller.
-function evaluateDriverSession(session, sm) {
-  if (!session) return { ok: false, tier: null, error: "No session was bound to this request." };
   if (session.mode === "tui") {
     return {
       ok: false,
-      tier: null,
       error: "An embedded terminal session cannot take the Driver role.",
     };
   }
-  var vendor = session.vendor || "claude";
-  var fallback = (sm && sm.defaultModelByVendor && sm.defaultModelByVendor[vendor]) || "";
-  var model = session.model || fallback;
-  return evaluateDriverModel(vendor, model, sm && sm.modelsByVendor);
+  return { ok: true, error: null };
 }
 
-function isEligibleDriverSession(session, sm) {
-  return evaluateDriverSession(session, sm).ok;
+function isEligibleDriverSession(session) {
+  return evaluateDriverSession(session).ok;
 }
 
 module.exports = {
-  FAMILIES: FAMILIES,
-  evaluateDriverModel: evaluateDriverModel,
   evaluateDriverSession: evaluateDriverSession,
   isEligibleDriverSession: isEligibleDriverSession,
-  resolveTier: resolveTier,
 };

package/lib/session-pair-factory.js

@@ -22,11 +22,10 @@
 //
 // Two ordering rules matter and are load-bearing:
 //
-//   1. Nothing is created until everything is validated. Driver eligibility and
+//   1. Nothing is created until everything is validated. Driver capability and
 //      both runtime requests are settled first, so a rejected request leaves no
-//      orphan session behind. For a newly requested Driver the tier is checked
-//      against the model that session would actually resolve to, before either
-//      session exists.
+//      orphan session behind. Any installed, available model may be the Driver;
+//      model choice is the user's rather than a server-side tier policy.
 //   2. `preflightRuntime` is side-effect free, so a caller that is about to
 //      destroy something (replacement dissolving a live pair) can validate the
 //      replacement first and abort while the old pair is still intact.
@@ -140,14 +139,6 @@ function attachPairFactory(ctx) {
       groupName = undefined; // auto name from member titles
     } else {
       driverRuntime = preflightRuntime(driverSpec, "claude");
-      // The tier is judged on the model this session would really resolve to:
-      // the explicit request if there is one, else that vendor's default.
-      var effectiveDriverModel = driverRuntime.model ||
-        (sm.defaultModelByVendor && sm.defaultModelByVendor[driverRuntime.vendor]) || "";
-      var newVerdict = driverEligibility.evaluateDriverModel(
-        driverRuntime.vendor, effectiveDriverModel, sm.modelsByVendor
-      );
-      if (!newVerdict.ok) throw new Error(newVerdict.error);
       groupName = "Agent pair";
     }
 
@@ -202,7 +193,7 @@ function attachPairFactory(ctx) {
   }
 
   function createWorkerForDriver(driver, args) {
-    // Validates the Driver's eligibility and the whole Worker runtime before
+    // Validates the Driver's capability and the whole Worker runtime before
     // any session is made, so a rejection creates nothing.
     var runtime = preflightWorkerForDriver(driver, args);
     var ws = {

package/lib/session-spawn-mcp-server.js

@@ -27,7 +27,7 @@ function getToolDefs(handlers) {
   return [
     {
       name: "spawn_sessions",
-      description: "Create sibling work sessions in this project. Set forkFromCurrent to copy this session's full conversation context into every child. Children share the project's working directory, so prefer parallel analysis or other non-conflicting work over concurrent edits. Results can be polled with check_spawned_sessions; spawned children cannot spawn further sessions.",
+      description: "Create ordinary sibling work sessions for background parallel work. This does not create a visible Driver/Split Worker pair and must not be used when the user asks for a Worker, paired pane, or split collaborator; use send_to_partner for that. Set forkFromCurrent to copy this session's full conversation context into every child. Children share the project's working directory, so prefer parallel analysis or other non-conflicting work over concurrent edits. Results can be polled with check_spawned_sessions; spawned children cannot spawn further sessions.",
       inputSchema: buildShape({
         sessions: { type: "string", description: "JSON array of objects: [{\"title\":\"Task title\",\"prompt\":\"Task instructions\"}]" },
         vendor: { type: "string", description: "Optional vendor id. Defaults to the parent session vendor, then the project default." },

package/lib/yoke/adapters/claude.js

@@ -260,6 +260,18 @@ function flattenEvent(raw) {
       base.status = raw.status;
       return base;
     }
+    // API retry notices are transient transport state, not conversation
+    // errors. Preserve the structured counters so the host can bound overload
+    // churn without recording one red error row per SDK retry.
+    if (raw.subtype === "api_retry") {
+      base.yokeType = "api_retry";
+      base.attempt = raw.attempt || 0;
+      base.maxRetries = raw.max_retries || 0;
+      base.retryDelayMs = raw.retry_delay_ms || 0;
+      base.error = raw.error || "unknown";
+      base.errorStatus = raw.error_status == null ? null : raw.error_status;
+      return base;
+    }
     if (raw.subtype === "task_started") {
       base.yokeType = "task_started";
       base.parentToolId = raw.tool_use_id;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "clay-server",
-  "version": "4.0.0-beta.13",
+  "version": "4.0.0-beta.14",
   "description": "Self-hosted team workspace for Claude Code and Codex. Multi-user, browser-based, with persistent AI mates.",
   "bin": {
     "clay-server": "./bin/cli.js",